Ransomware negotiator hired to represent victims was working for the attackers

“As part of his duties, the defendant was provided with details regarding the attack and information regarding the ransom demand and typically the victim’s applicable insurance coverage and negotiating strategy,” the factual proffer said.

Martino used BlackCat’s live chat system to negotiate ransom payments. Starting in April 2023, he “began communicating with BlackCat actors through the messaging platform Tox and in a separate ‘intermediary chat’ tab of the BlackCat panel,” which “was only accessible to the defendant and the BlackCat negotiators and affiliates,” the factual proffer said.

Martino used the intermediary chat tab to provide confidential information about clients.

“The purpose of these intermediary chat communications was to maximize the ransom payments paid by those victims to the BlackCat actors,” the court document said. “This information provided by the defendant without the victims’ knowledge included the victims’ insurance policy limits and internal negotiation positions. In exchange for providing confidential information, the defendant received a portion of the ransomware payments in digital currency.”

In May 2023, Martino obtained affiliate access to the BlackCat panel, and he shared that access with the co-conspirators. “After the defendant obtained affiliate access, the defendant, Co-conspirator 1, and Co-Conspirator 2 agreed to, and did use the BlackCat ransomware and platform to attack and extort victims and share the ransom proceeds amongst themselves and with the BlackCat admin,” the factual proffer said.